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YES, DON, THI 


Because you 


Yes, Don, there ta an ELINT! 
don't recognize it, doesn't mean it doesn't 


exist. Your NSA colleagues who plant its 
seeds, who nurture its growth, who channel its 
energies, and who harvest its fruits resemble 
in many ways the more ‘normal NSA employee. 
You might, therefore, have as much difficulty 
recognizing an ELINTer as you do ELINT, but, 
believe me, they exist too. 


In the April issue of CRYPTOLOG you asked 
if the real ELINT would stand up.* You indi- 
cated that it appears to be a shadowy operation 
and that many COMINTers would like to know what 
it is all about. Happy to oblige. We ELINTers 
have been so busy practicing our science (art?) 
that we didn't notice all of you waiting to be 
enlighted in the ways of ELINT -- perhaps to 
join the fun. We're a proud bunch who know we 
are an NSA minority specialty group with an im- 
portant job to do, and we think that we're do- 
ing it rather well. We can do it even better, 
and we are working at that. We will attempt to 
throw light into the shadows, remove mystery, 
and minimize jargon. 

Formal definitions of ELINT do in fact in- 
clude all non-communications electronic emis- 
sion intelligence except lightning and nuclear 
emissions. As practiced at NSA, our energies 





* Don Bulla, "Will the Real ELINT Please 
Stand Up?", CRYPTOLOG, April 1976, p. 5S. 
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are devoted primarily to ELINT associated with 
potentially hostite military-threat weapon sys~ 
tems. Yes -- this represents the analysis of weap- 
on systems primarily through their radars, radar- 
like devices, weapon-control electronics, jam- 
ming signals associated with all of these, and 
the jamming of communications signals. 


NSA partitions ELINT into two classes: 
Operational ELINT and Technica) ELINT. {Tele- 
metry -- TELINT -- is the province of Wl. 
Perhaps they will tell you about that some- 
time.) Since October 1974, most Operational 
ELINT activities are handled by the appropriate 
A, 8, or G Group analytic elements. Technica} 
ELINT is focused in W's Office of ELINT, W2. 
What is the difference? Simply stated, the 
following illustrates tne products of the two 
types of ELINT information. 


Technical ELINT provides: 


© signal descriptions ~~ All the parameters of 
a signal that can reasonably be defined are 
collected and measured to a degree commen- 
surate with our capability and the degree 
of military interest. These measurements 
provide the ingredients for analysis of the 
emission characteristics and assessment of 
the emitter. 


= emisston characteristica -~ The signals (and 
combinations of signals) are analyzed From 
signal descriptions. The character of the 


August 76 * CRYPTOLOG * Page 1 


GSREREos 


EO 3.3b{3) 
PL 86-36/50 USC 3605 





emissions is determined to establish how 
best to exploit them and to gain insight 
into the degree of threat they may represent 









So what does Operdtional ELINT provide that 
has not been discussed? On those emitters 
described by Technical ELINT, 


Operational ELINT provides: 
w emitter deployment 





-sustem assoctations 
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Since space is limited, and since the au- 
thor's current responsibilities encompass 
Technical ELINT, the remainder of this article 
will be devoted to Technical ELINT. Perhaps a 
representative of A, B, or G Group will elabo- 
rate on Operational ELINT in a subsequent is- 
sue of CRYPTOLOG. 


As outlined earlier, Technical ELINT is in 
general aimed at: 

@ understanding military threat weapon 
systems; 





e providing similar information on jamming 
signals. 


While the following remarks are neither com- 
prehensive nor intended to show the "only" way 
that things happen in Technical ELINT, they 
should serve to illustrate the basic activities 
of Technical ELINTers. 


a Requirements definition -- Requirements are 
generated by the military operating command- 
ers expressing their need for information on 
a potentially hostile new emitter (for exam- 
ple, a new radar) or by their associated 
service intelligence agency analysts who are 
aware of the new radar and generate require- 
ments on behalf of the operating commanders. 
These service intelligence agencies are the: 


a Foreign Technology Division (FID), for 
the Air Force; 

a Miastle Intelligence Agency (MIA), for 
the Army's large missile systems; 

« Foreign Science and Technology Center 
(FSTC), for the Army's general battle- 
field systems and electronic-warfare 
intelligence; and 


« Naval Intelligence Support Center (NISC), 


for the Navy. 


The need for ELINT information is genera- 
ted by and through these service centers 
and forwarded to DIA for consolidation and 
validation. DIA, in turn, levies the re- 
quirements on NSA. 


The W2 Requirements/Collection Managers 
(with the appropriate analysts) convert the 
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DIA weed for ELINT information into specific 
colléction/processing/analysis guidance de- 
tailing the character off the data needed 
from the world-wide variety of collection 
reseurces. Working with V3, W2 has the data 
neets and reporting instructions forwarded 
tothe collectors who can contribute -- 
offen these instructions are specifically 
tailored to their abiljty to contribute. 


2 Collection and collection management -- W2 


performs both collect fon_and collection 
management functions. 





= Processing and processing management -- As 


with other steps in the ELINT procedure, 
processing of collected data is accomplished 
in a variety of ways. Processing is defined 
as the step between signal collection and 
analysis {to be defined later). Processing 
is accomplished at the point of collection, 
at theater processing centers, and Hq NSA. 
Again, NSA ELINTers have considerable impact 
on the quantity, quality, and location of 
ELINT processing. 


uw Analysia and analyeie management -- ELINT 
analysis is defined as that part on the 
ELINT production cycle wherein analog and 
digital data is converted into intelligence 
information. Hq NSA ELINTers perform a 
substantial level of analysis; directly man- 
age analysis by contractors on specialized 
problems; provide general analysis assistance 
and management to collectors and processing 
centers; and are directly involved in the 
management of analysis assistance being pro- 
vided by the service science-and-technology 
centers (FTD, MIA, FSTC, and NISC) by formal 
agreement between NSA, DIA, and the centers. 
The analysis and analysis management function 
presents considerable technical and managerial 
challenge, but the challenge is being met 
with reasonable efficiency. 


« Reporting and reporting management -- The 


best intelligence information is absolutely 
worthless until it is reported, and used, by 
those who take action on the basis of such 
information. Thus, since we cannot force the 
customers to use our product, our challenge 
is to report all potentially useful informa- 
tion in as complete, timely, and readable a 
format as possible, with the important ele- 
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ments highlighted. With the vast variety of 
processes and procedures that lead up to the 
dissemination of an end-product report (in- 
cluding a variety of field reporting proce- 
dures), it is very difficult to keep the 
operation glued together. Currently, there 
is a very complex array of "field" reporting 
procedures and vehicles. There is also cur- 
rently, however, a comprehensive reporting 
procedure etudy underway, with the objective 
of simplifying the process. As in the song, 
we have "High Hopes." 


The foregoing paragraphs are designed to 
give you a very quick survey of ELINT -- 
especially Technical ELINT -- as practiced at NSA. 


So what havé we done for you Zately? 
Plenty! -- most of which should not be revealed 
in a broad-distribution publication. Come tous 
with yodr clearances and need-to-know intact and 
we wtll be happy to tell you. 

















goodies provided by ELINTers are more 
valuable than gifts he received from Santa 
Claus. We ELINTers work so closely with our 
electronic warfare "customers, contractors, a 
rather broad range of COMINTers and many others 
that we sometimes lose sight of the fact that we 
are (in number) a small part of the SIGINT effort 
and that we are well known to only a relatively 
few. We thank you for your reminder that we do 
need to pause occasionally for a bit of public- 
relations exposure, even within the Agency. 

Hope this short discussion helps. Want to know | 


more? Contact us. 
ad 
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During St_year, CADRE, a Pi/RS1 group 
headed by has been investigating 
cluster analysis and multidimensional scaling 
and has been assessing the relevance of those 
techniques to Agency work. A number of computer 
,programs implementing those methods have been 
acquired and adapted to Agency computers. 


Two hierarchical clustering algorithms, 
HICLUST and PEP-1, have proved to be quite use- 
ful in a variety of Agency problems. CADRE has 
studied several cryptanalytic applications with 
highly encouraging results. For example, for 
matching alphabet profiles, HICLUST and PEP-1 
have been demonstrated to be substantially bet- 
ter (in the sense of producing a more accurate 
result) than the XIBAR method, the traditional 
Agency approach based on cross I.C. values. 
Furthermore, recent R51 research suggests that 
the cross I.C. measure itself may be signifi- 
cantly inferior to other types of comparisons 
such as correlation coefficients, normalized 
dot products, and Euclidean distances, 


Cluster analysis seeks to categorize n 
objects, each defined in terms of values associ~ 
ated with p variables or attributes, into g 
homogeneous subsets (clusters). Clustering al- 
gorithms may be classified as being either hier~ 





archicai or nonhierarchical in nature. In hier- 
archical clustering, a set of nested clusters is 
obtained ranging from one set containing all n 
objects to m sets each containing one object. 


Hierarchical techniques may be subdivided into 
agglomerative (merging) and divisive (splitting) 
strategies. Hierarchical-agglomerative methods 
begin with n clusters, each containing one ob- 
ject, and proceed by a series of successive 
fusions of nearby clusters until one cluster 
containing aJ1 objects is obtained. Hierar- 
chical-divisive methods begin with all n objects 
in one cluster and produce successive splitting 
into finer subsets. 


HICLUST (Hlerarchical CLUSTering) is a 
hierarchical-agglomerative method using the 
nearest-neighbor and farthest-neighbor algo- 
rithms, FEP-1 (Probablity Evaluated Partitions, 
Version 1) is a hierarchical-divisive method 
using graph-theoretic concepts. HICLUST was 
written at Bell Labs; PEP-1 is a member of the 
Guttman-Lingoes Nonmetric Program Series (Uni- 
versity of Michigan Psychology Department). 


All clustering algorithms are designed to 
produce clusters regardless of the structure of 
the data. Most clustering techniques make as- 
sumptions concerning the number and shapes of 
clusters in the data. HICLUST and PEP-1 attempt 
to produce clusters using the intrinsic struc- 
ture of the data, and both programs (especially 
PEP-1) generate statistics to help the analyst 
differentiate clusters from random groupings. 


Both HICLUST and PEP-1 analyze a square 
symmetric matrix whose entries measure either 
the distance or the likeness between objects. 
Both programs are very easy to operate and 
are available on LODESTAR, the IBM 370, and 
the RS 6600. 


Here is an example which illustrates the 
type of situation in which PEP-1 and HICLUST 
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have proved to be valuable. Suppose a cipher 
stream is suspected of having been generated 
by a periodic polyalphabetic system with a 
50-wide key, and the objective is to determine 
the number of different alphabets (or different 
slides of the same alphabet} used and the key 
positions that are enciphered with the same 
alphabet. 


Such a problem was solved in 1974 using 
statistical programs available on the RYE com- 
puter system. In 1976 this cipher was reexam- 
ined by CADRE using modern cluster analysis and 
multidimensional scaling methods. The CADRE 
techniques easily (and perfectly) determined 
the number of alphabets used and the key po- 
sitions enciphered by the same alphabet. A 
hierarchical-clustering representation of the 
results from HICLUST and PEP-1 is shown in 
Fig. 1. The clusters can be interpreted in a 
more meaningful fashion by means of the matrix 
in Fig. 2. 

The statistics generated by PEP-1 and 
HICLUST, coupled with Fig. 2, clearly estab- 
lish the validity of the clustering. 





24 12 
38 16 
42 26 
30 
34 
40 
44 
48 


Hierarchical clustering of PEP-1 
and HICLUST results 


Fig. 1. 
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More details about this ‘exampte (and about 
additional examples invptving typewrfter-random 
key generation and codebook resonstrijction) can 
be found in the recently publshed RS1 * aper, 
The Hierarchical ape righ ey Cryptana, ate 


Data and © idimens to: 
Sealing, b land 
(RS1/TECH/0 rch ‘ou may 


f) a_ copy of this paper by calling Mrs. 
on the RSI Libfary, Room SNIOL- -3, 
is}. . 


CADRE is investigating more sophisticated 
Clustering approaches and also multidimensional 
scaling methods (for the case in which a para- 
digmatic structure; such as a linear br circular 
ordering of the ppints, is sought inatead of 
clusters). To further extend its research ef- 
fort, CADRE is dctively seeking data sets 
(cryptanalytic,or other) from numerous Agency 
offices. Inquiries about the computet programs 
used by CADRE or questions about submission of 


dare sets for analysis should be directed either 
oft RS1, $530s, a cee | R51, 


Slide 





Key positions enciphered by each slide 











1 1 33 - 47 
2 2 34 - 48 
3 3 35 - 49 
4 4 36 - 50 
5 5 37 41 - 
6 6 38 942 - 
7 7 3943 - 
8 48 - 40 44 - 
9 245 + 2 31 - 45 - 
10 [10 14 - 28 «32 = 46 = 
Fig. 2. Interpretation of cluster 


structure after revision 
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On the other hand, in spite of the resource 
decrement, the intelligence requirement contin- 
ues. SIGINT remains our first line of defense, 
and it is incumbent upon us to respond to this 
charge with all the resourcefulness we can 





muster. 
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If you are still with me to this point, 
please don't send me any letters saying that 
we are already doing allofthis. For each case 
you cite wherein the full objective has been 
achieved, I can cite two or three wherein the 
objective was either ignored or effectively 
undermined, and that is not oy purpose in any 
case. What I am earnestly requesting is that 
this Agency recognize an area which will be of 
vital importance in the future, and take every 
reasonable step to insure we are upto the chal- 
lenge. If we are to succeed, as succeed we 
must, we need to be innovative, thorough, de- 
liberate, and, above all, cohesive in our in- 
tegrated analyst program management; and it is 
within our capabilities to do so. We, as an 
Agency, should not settle for anything less. 


RSS E Rae 
ee ee ee 


August 76 * CRYPTOLOG * Page 14 


eGR mae peer oeenbeemiiey 


UNCLASSIFIED 


August 76 * CRYPTOLOG * Page 15 


UNCLASSIFIED 


Non - Responsive 


UNCLASSIFIED 


August 76 * CRYPTOLOG * Page 16 


UNCLASSIFIED 


Non - Responsive 





UNCLASSIFIED 


August 76 * CRYPTOLOG * Page 17 


UNCLASSIFIED 








August 76 * CRYPTOLOG * Page 19 


EERO 








August 76 * CRYPTOLOG * Page 20 








August 76 * CRYPTOLOG * Page 21 





